GitHub Advisoryadvisory · npm

GHSA-m99w-x7hq-7vfj Next.js: Denial of Service in App Router using Server Actions

HIGH Published 2026-07-22 Modified 2026-07-22 Official page ↗
Aliases
CVE-2026-64641
Ecosystem
npm
Packages
next
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-834
Reviewed
2026-07-22

Affected packages

• npm next: >= 13.0.0, < 15.5.21 → fixed in 15.5.21 • npm next: >= 16.0.0, < 16.2.11 → fixed in 16.2.11

Description

Impact Crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. Workarounds No workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.

Related

Alias · CVE (1)

  • CVE-2026-64641 Next.js is a React framework for building full-stack web applications. vulnerability

Weakness · CWE (1)

  • CWE-834 Excessive Iteration weakness

References